• There is NO official Otland's Discord server and NO official Otland's server list. The Otland's Staff does not manage any Discord server or server list. Moderators or administrator of any Discord server or server lists have NO connection to the Otland's Staff. Do not get scammed!

OTClient Blocking clients other than the official.

B

Brhunter

New Member
Joined
Jun 29, 2024
Messages
13
Reaction score
1
I would like to block the possibility of logging in from clients other than the official one of my server. How to do it? Change RSA? I can't find any guide. please help
 
Sort by date Sort by votes
Brhunter said:
I would like to block the possibility of logging in from clients other than the official one of my server. How to do it? Change RSA? I can't find any guide. please help
Click to expand...
Here you go
otland.net

[Tutorial] Generate RSA keys

After recent changes to tfs 1.3 by @Lordfire the rsa private key is now loaded from PEM file & it might be a bit confusing for some to generate custom rsa This tutorial requires openssl to be installed on your system. Debian & Ubuntu have it pre-installed. First generate your private key...
otland.net otland.net
otland.net

TFS 1.X+ - Key.pem struggling

Hi! I have some troubles linking my server and client via rsa. I use Nekiro TFS 1.4 downgrade 8.6, and trying to link to a Tibia Cipsoft 8.6 client with extended sprites. For this, first I follow this tutorial from @Sun [Tutorial] Generate RSA keys...
otland.net otland.net
 
Upvote 0 Downvote
Brhunter said:
I don't understand it completely. OTS RSA Generator (https://ots.me/rsa/) can I use this generator instead of entering commands? where to put the rsa generated in the link?
Click to expand...

  • You generate the RSA by refreshing the page.
  • OTS RSA Generator > N (modulus) - for OTClient > This is the RSA Code you need to put into your modules/gamelib/const
  • OTS RSA Generator > key.pem - for new servers > This is the RSA Code you need to put into your Servers Root Folder, there is a file called Key.pem, open that with notepad.
 
Upvote 0 Downvote
Tenzhiro said:
  • You generate the RSA by refreshing the page.
  • OTS RSA Generator > N (modulus) - for OTClient > This is the RSA Code you need to put into your modules/gamelib/const
  • OTS RSA Generator > key.pem - for new servers > This is the RSA Code you need to put into your Servers Root Folder, there is a file called Key.pem, open that with notepad.
Click to expand...

Thank you very much for help. I have a problem with key.pem. I create a key.pem file in the main TFS directory but when the server starts, no information about key.pem or rsa is displayed and I can also connect to otclient with the default RSA.

By default, I didn't have key.pem anywhere in my tfs 1.3 and I created this file myself, but it didn't help. I also don't have any key.pem option in config.lua.

Is it possible that I have blocked the use of custom rsa?
 
Last edited:
Upvote 0 Downvote
Brhunter said:
Thank you very much for help. I have a problem with key.pem. I create a key.pem file in the main TFS directory but when the server starts, no information about key.pem or rsa is displayed and I can also connect to otclient with the default RSA.

By default, I didn't have key.pem anywhere in my tfs 1.3 and I created this file myself, but it didn't help. I also don't have any key.pem option in config.lua.

Is it possible that I have blocked the use of custom rsa?
Click to expand...
Isn't RSA in 1.3 a bit different as in there is no key.pem but you need to change RSA in the sources, it should be in the file configmanager.cpp
 
Upvote 0 Downvote
Tenzhiro said:
Isn't RSA in 1.3 a bit different as in there is no key.pem but you need to change RSA in the sources, it should be in the file configmanager.cpp
Click to expand...
Thank you very much for your help. However, RSA is edited in otserv.cpp and I have a few questions:
1. In this case, should I change: const char* p and const char* q to
P (prime1) - for old servers: and Q (prime2) - for old servers: from OTS RSA Generator (https://ots.me/rsa/) ?
Post automatically merged:

when I put new rsa in \modules\gamelib\const.lua will it be safe? I have an updater on the website and players will be able to view this rsa and insert it into their bot client. how to do it safely?
 
Last edited:
Upvote 0 Downvote
Brhunter said:
Thank you very much for your help. However, RSA is edited in otserv.cpp and I have a few questions:
1. In this case, should I change: const char* p and const char* q to
P (prime1) - for old servers: and Q (prime2) - for old servers: from OTS RSA Generator (https://ots.me/rsa/) ?
Post automatically merged:

when I put new rsa in \modules\gamelib\const.lua will it be safe? I have an updater on the website and players will be able to view this rsa and insert it into their bot client. how to do it safely?
Click to expand...
use the guide to generate the rsa, not the generator. replace your public.pem, and just set the other key at const.lua. the last thing you need is to encrypt the client, if you're using mehah otclient, use the following settings to set-up the encryption

C++: 
#define ENABLE_ENCRYPTION 1

#define ENABLE_ENCRYPTION_BUILDER 1

#define ENCRYPTION_PASSWORD "MYPASSWORD"

if builder is active, you can use this on command prompt
Code: 
otclient.exe --encrypt

if it's not, that's the client you need to enter the game. if you switch encryption to 1, it will need the encrypted files, if is set to 0, it will enter without encryption. that's all for hiding your rsa, for otclientv8 I don't know how it's done since I dont use it. Regards!
 
Upvote 0 Downvote
What's even the point of changing RSA if it can be read directly from the memory of the running client? Just use e.g. CheatEngine to search for a string with a length of 309 characters, copy it and use it in your client.
 
Upvote 0 Downvote
check said:
What's even the point of changing RSA if it can be read directly from the memory of the running client? Just use e.g. CheatEngine to search for a string with a length of 309 characters, copy it and use it in your client.
Click to expand...
That's true? then how to get rid of bots?
 
Upvote 0 Downvote
Brhunter said:
That's true? then how to get rid of bots?
Click to expand...
The purpose of the RSA encryption is not to stop bots, but to secure the client-server communication (login data in particular) against the "man in the middle".
If you change the default keys, it can stop some of the already made bots from working - but only those that rely on taking over the communication and only those that aren't being updated. If a bot can be updated it won't serve a big obstacle, and if for example a bot relies on reading the client's memory and sending input events it won't be bothered at all.
You do not get rid of botters by any "one simple trick". It's a lot of work that has to be done day in day.
check said:
What's even the point of changing RSA if it can be read directly from the memory of the running client? Just use e.g. CheatEngine to search for a string with a length of 309 characters, copy it and use it in your client.
Click to expand...
You can read the public key, but not the server's private key, meaning that you can only encrypt messages for the server but not decrypt them. That could be the point... Public-key cryptography - Wikipedia (https://en.wikipedia.org/wiki/Public-key_cryptography)
Yes, it's irrelevant for bots, but that's not the reason why it was even implemented.
 
Upvote 0 Downvote
Everything above is true, but I was referring to the topic of the thread - "how to block clients other than the official one" - so changing RSA alone will not block other clients. Moreover, RSA is only used to encrypt login data during the first packet to the login and game server - further encryption is done using XTEA, where the keys, just like the RSA string, can also be easily read from the client's memory.
 
Upvote 0 Downvote
Back
Top